MalwareEducationEducationRansomwareData ExfiltratedData EncryptedRansom DemandedSupply Chain (3P Vendor)Customer Data InvolvedIdentity (basic)Government IDFinancial accountHighContained

ST. PAUL'S SCHOOL

bd_1f08fb1d2dabf241 · schema v1 · pii pii-v1

Severity

High

Discovered

Jul 16, 2020

Filed

Jan 22, 2021

To disclose

27 weeks

Affected

1,814state residents only

Linked

4 filings

Confidence

66%

Full breach record for ST. PAUL'S SCHOOL →2 incidents on file

St. Paul's School (NH) notified the NH Attorney General of a ransomware incident at third-party vendor Blackbaud. Unauthorized access occurred Feb 7–May 20, 2020. Blackbaud exfiltrated backup files containing donor names, SSNs, and financial account info. 1,814 NH residents were affected. Notifications were mailed Jan 21, 2021, offering 2 years of credit monitoring. Blackbaud paid a ransom and destroyed stolen files.

J jump to incidentP pin to compareR raw source

Incident timeline

undetected · 160 days

discovery → filing · 27 weeks / 190 days

Feb 7, 2020

Begins

Jul 16, 2020

Discovered

Jan 22, 2021

Filed

This filing is one of 4 filings about the same incident.View merged incident

Part of BLACKBAUD, INC. supply-chain incident (2020) — a supply-chain cascade affecting multiple organizations.View cascade →

Linked disclosures

Why this link?

Regulatory filings (3) · sorted by filing gap

Maine State AGbd_0892db25ad0d5cae2021-01-21 · +1dCandidate
Indiana State AGbd_617de6b06b63bb8f2021-01-21 · +1dVerified
Massachusetts State AGbd_90c38f80ac0b7be82021-01-21 · +1dVerified

Name: ST. PAUL'S SCHOOL
norm: st paul s school

Name: ST. PAUL'S SCHOOL
norm: st paul s school
Industry: Educationllm

Discovered: Jul 16, 2020
Breach occurred: Feb 7, 2020 – May 20, 2020
Undetected for: 160 daysoccurrence → discovery
Materiality determined: —
Notification sent: Jan 21, 2021
Affected individuals: 1,814state-resident count only
Data types: Identity (basic)Government IDFinancial account
Data elements: Social Security number
Attack vector: Ransomware
MITRE ATT&CK: T1486 Data Encrypted for ImpactT1041 Exfiltration Over C2 Channel
Threat actor: ExternalFinancial
Regulator citations: Notified Attorney General Gordon MacDonald
Initial access: exploit_public_facing

During the incident: SPS launched its own investigation to identify the individuals whose information may have been involved
SPS is mailing notification letters to the New Hampshire residents via United States Postal Service First-Class mail
SPS is offering the New Hampshire residents complimentary, two-year memberships to credit monitoring and identity theft prevention services
SPS has established a dedicated phone number where the individual may obtain more information regarding the incident
Changes made: SPS is re-evaluating its relationship with Blackbaud and reviewing the security requirements it has for its data solution service vendors
Blackbaud identified and fixed the vulnerability associated with this incident
Blackbaud implemented several changes that will better protect data
Blackbaud is undertaking additional efforts to improve the security of its environment through enhancements to access management, network segmentation, and deployment of additional endpoint and network-based platforms
Source: Quoted from the filing itself, not independently verified.

Time to disclose: 27 weeks(190 days from discovery to filing)
Compliance flags: — (clock not assessable for this source)

Status: No extraction artifact recorded for this disclosure.

Filing propagation · 4 filings · 4 states

View merged incident ↗

Maine State AGJan 21 · first

Indiana State AGJan 21 · first

Massachusetts State AGJan 21 · first

New Hampshire State AG+1d · this page

Evidence ladder

Leak-site claim

Attacker assertion only. Establishes: claim date, group, alleged victim.

Press / market report

Unlocks: incident narrative, operational impact. Still no compliance clock.

State AG / regulator filingThis record

Unlocks: discovery date, data types, affected count, compliance clock.

SEC 8-K / victim statement

Unlocks: materiality, stated response, full audit trail. Ceiling removed.

Source URL: https://mm.nh.gov/files/uploads/doj/remote-docs/st-pauls-school-20210122.pdf
DisclosureLens links to the originating regulator URL — full filing bodies are not redistributed from public surfaces (§4.5).
Filed at: Jan 22, 2021
Raw hash: aee5a9639700403219f4a7f7a44ca6b58c24364f94fd3c5edfb41f5ba0b8c7df

Linked disclosures

Regulatory filings (3) · sorted by filing gap

Reporting entityST. PAUL'S SCHOOL

Victim entityST. PAUL'S SCHOOL

Incidentdiscovered Jul 16, 2020

Stated responseSPS launched its own investigation to identify the individuals whose information may have been involved

Complianceclock not assessable

Extraction provenanceno artifact recorded

Source provenancemm.nh.gov